Feb 14 · 6 min read · By this point in the series, we’ve established three things: Passwords are structurally fragile. WebAuthn provides phishing-resistant, device-bound authentication. OpenID Connect provides portable, federated identity. Now comes the harder questi...
Join discussion
Feb 12 · 6 min read · If WebAuthn answers the question: “Can this device prove control of a credential right now?” OpenID Connect answers a different question entirely: “Who is this person across systems, time, and organizations?” Modern authentication systems fail wh...
Join discussion
Dec 31, 2025 · 6 min read · Fig: How OpenID Connect and PKCE works combinely How OpenID Connect (OIDC) and Proof Key for Code Exchange (PKCE) Work Together Introduction In the world of modern web and mobile authentication, OpenID Connect (OIDC) and Proof Key for Code Exchange (...
Join discussionDec 8, 2025 · 8 min read · Series: Web Authentication Demystified — From Concepts to Real-WorldARC 1 — FOUNDATIONS OF USER AUTHENTICATIONPrevious: Understanding OAuth2 & OpenID Connect (OIDC)Next: Sessions vs Token-Based Authentication Modern web and mobile applications rely o...
Join discussion
Sep 11, 2025 · 2 min read · 기존의 OAuth 2.0을 보완하기 위한 여러 시도가 있습니다. 그 중 PKCE 그리고 더 발전된 형태인 OAuth 2.1에 대해 간략히 알아보겠습니다. PKCE (Proof Key for Code Exchange) PKCE는 악의적인 애플리케이션이 인증 코드를 가로채는 것을 방지하는 방법에 대한 내용입니다. OAuth 2.0 인증과정 중 Authorization code가 탈취 OAuth 2.0의 흐름 중 다음과 같은 과정이 있습니다. Re...
Join discussion
Sep 4, 2025 · 3 min read · Imagine waking up one morning to find your digital door wide open—bank alerts, strange emails, and your social accounts whispering conversations you never started. Sound far-fetched?Last year alone, digital fraud hit record highs, with millions losin...
Join discussion
Sep 1, 2025 · 6 min read · Remember when you only had one password for everything? That era is long gone. Today, apps, cloud services, and AI agents all need to talk to each other — securely, automatically, and at scale. The silent hero making this possible: OAuth. How many a...
Join discussion
May 29, 2024 · 5 min read · In the previous section, we got to know how to get the authorization code from Auth endpoint of server by sending client id and code_challenge.Once this is done, our next thing is to use this client id, code and code verifier to generate access token...
Join discussionMay 28, 2024 · 3 min read · OAuth 2.0 OAuth 2.0 is a industry standard authorisation technique used in many applications. PKCE is the extension of OAuth 2.0 which uses code_challenge and code_verifier to get access token in client applications. In native applications, we usuall...
Join discussionApr 4, 2024 · 9 min read · PKCE, which stands for “Proof of Key Code Exchange”, and is pronounced “pixy,” is an extension of the OAuth 2.0 protocol that provides an additional security layer helping to prevent intercept attacks. Articles about OpenZiti often discuss applicatio...
Join discussion